@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/dist/execution/types.d.ts

@@ -137,7 +137,7 @@ export interface DurableExecution {
     start(handlers: WorkerHandlers): Promise<void>;
     /**
      * Stops delivering, aborts running advances' signals and waits for them, up to the
-     * implementation's stop grace (`DEFAULT_STOP_GRACE_MS`). Handlers still running then are
+     * implementation's stop grace (Host tuning `execution.stopGraceMs`). Handlers still running then are
      * abandoned: their sessions' leases lapse and the next advance takes over (§11.4).
      */
     stop(): Promise<void>;
@@ -178,11 +178,6 @@ export declare function parseSessionKey(key: string): {
     tenantId: string;
     sessionId: string;
 };
-/**
- * Default time `DurableExecution.stop` waits for running handlers after aborting them: the
- * advance grace period (`DEFAULT_ADVANCE_GRACE_MS` in `tenant/worker.ts`).
- */
-export declare const DEFAULT_STOP_GRACE_MS = 30000;
 /**
  * Waits until `inflight` is empty (it shrinks as its promises settle and may grow meanwhile),
  * for at most `graceMs`. Resolves to how many were still running when the grace ran out.

package/dist/execution/types.js

@@ -62,11 +62,6 @@ export function parseSessionKey(key) {
         throw new Error(`Invalid session key: ${key}`);
     return { tenantId: key.slice(0, at), sessionId: key.slice(at + 1) };
 }
-/**
- * Default time `DurableExecution.stop` waits for running handlers after aborting them: the
- * advance grace period (`DEFAULT_ADVANCE_GRACE_MS` in `tenant/worker.ts`).
- */
-export const DEFAULT_STOP_GRACE_MS = 30_000;
 /**
  * Waits until `inflight` is empty (it shrinks as its promises settle and may grow meanwhile),
  * for at most `graceMs`. Resolves to how many were still running when the grace ran out.

package/dist/gates/contract.d.ts

@@ -6,7 +6,8 @@
  * - Headers: `Authorization: Bearer <run token>` (F5, `tenant/run-token.ts`), `Idempotency-Key:
  *   <effect id>`, and optionally `Nylorun-Tenant: <tenant id>`, which must then be the token's
  *   Tenant. Core's credential (`NYLORUN_GATES_TOKEN`) is refused: only a run calls the model.
- * - Body: `ModelCallBody`, at most `MAX_MODEL_CALL_BYTES`. It names no session, turn or agent:
+ * - Body: `ModelCallBody`, at most the Tenant's Runtime limit `modelCallBytes` (`PUT
+ *   /v1/tenant/limits`, default 32 MiB). It names no session, turn or agent:
  *   the gate takes them from the token, and refuses a body that names them.
  * - `200 {outcome}` once the call has finished, whether the outcome is a candidate or a
  *   failure; nothing is sent while it runs. `401 gate_unauthorized` for a missing, malformed,
@@ -23,7 +24,7 @@
  * need not be live: a user cancel makes it stale, and still stops its call.
  */
 import type { ModelGateOutcome } from "./model-gate.js";
-export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, type GateErrorBody, type ModelCallBody, } from "@nylorun/core/harness-api";
+export { MODEL_CALLS_PATH, ModelCallBodySchema, type GateErrorBody, type ModelCallBody, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export declare const TENANT_HEADER = "nylorun-tenant";
 export interface ModelCallResponse {

package/dist/gates/contract.js

@@ -1,3 +1,3 @@
-export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, } from "@nylorun/core/harness-api";
+export { MODEL_CALLS_PATH, ModelCallBodySchema, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export const TENANT_HEADER = "nylorun-tenant";

package/dist/gates/egress-credentials.js

@@ -6,7 +6,7 @@
  * (keys holds its key; the pod trusts its certificate, `harness/pod.ts`), and reads HTTP/1.1
  * requests. For each request it reads the vault (one Postgres query, no cache, so a rotation
  * applies to the next request), sets the credential's header (replacing any of that name, such
- * as the `nylorun-managed` sentinel the CLI sent), and forwards it over TLS to the address the
+ * as the `nylorun_managed` sentinel the CLI sent), and forwards it over TLS to the address the
  * gate already checked, verifying the host's certificate by name against the public roots.
  *
  * Nothing here knows a tool: the header name and its format are the credential's. A release the
@@ -18,6 +18,7 @@
 import { createServer } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
+import { hostTuning } from "../tuning.js";
 /** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
 export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
 /** Headers that describe one hop and are never forwarded. */
@@ -62,7 +63,7 @@ export function credentialTerminator(options) {
         });
     });
     http.keepAliveTimeout = options.idleMs;
-    http.headersTimeout = 60_000;
+    http.headersTimeout = hostTuning().egress.credentialsHeadersTimeoutMs;
     // Uploads may be long; the client socket's idle timeout still applies.
     http.requestTimeout = 0;
     http.on("upgrade", (req, socket) => {
@@ -131,7 +132,7 @@ export function credentialTerminator(options) {
             };
             const agent = new Agent({
                 keepAlive: true,
-                maxSockets: 8,
+                maxSockets: hostTuning().egress.credentialsMaxSockets,
                 lookup,
                 ...(credentials.upstreamCa ? { ca: credentials.upstreamCa } : {}),
             });

package/dist/gates/egress.d.ts

@@ -18,7 +18,11 @@ export interface EgressSandboxes {
 }
 /** One connection's record (R7.3, D67): `environment.egress`'s payload. */
 export type EgressConnection = EnvironmentEventPayload<"environment.egress">;
-/** How many running turns one connection names, at most. */
+/**
+ * How many running turns one connection names, at most: fixed by the `environment.egress` event
+ * contract (`runningTurns` holds at most 16 in `/core/contracts`), which every reader
+ * validates against, so not a setting here.
+ */
 export declare const EGRESS_RUNNING_TURNS_MAX = 16;
 /** Where egress-gate records connections (R7.3, D67). */
 export interface EgressRecord {
@@ -29,14 +33,6 @@ export interface EgressRecord {
 }
 /** Ports a tunnel may open. */
 export declare const EGRESS_PORTS: readonly number[];
-/** Tunnels one sandbox may hold open at once. */
-export declare const EGRESS_MAX_PER_SANDBOX = 64;
-/** A tunnel with no traffic either way for this long is closed. */
-export declare const EGRESS_IDLE_MS: number;
-/** How long a sandbox's epoch and allowlist are reused before they are read again. */
-export declare const EGRESS_CACHE_MS = 5000;
-/** How long the gate waits for the upstream connection. */
-export declare const EGRESS_CONNECT_TIMEOUT_MS = 10000;
 export interface StartEgressGateOptions {
     readonly listen: {
         readonly host: string;
@@ -46,9 +42,13 @@ export interface StartEgressGateOptions {
     /** Verifies a presented egress token (`verifyEgressToken` over the Tenant's keys). */
     verify(raw: string): Promise<EgressTokenVerdict>;
     readonly sandboxes: EgressSandboxes;
+    /** A tunnel with no traffic either way for this long is closed. Default `egress.idleMs`. */
     readonly idleMs?: number;
+    /** Tunnels one sandbox may hold open at once. Default `egress.maxTunnelsPerSandbox`. */
     readonly maxPerSandbox?: number;
+    /** How long a sandbox's epoch and allowlist are reused. Default `egress.cacheMs`. */
     readonly cacheMs?: number;
+    /** How long the gate waits for the upstream connection. Default `egress.connectTimeoutMs`. */
     readonly connectTimeoutMs?: number;
     /** Tests replace name resolution. */
     readonly lookup?: (host: string) => Promise<readonly {

package/dist/gates/egress.js

@@ -27,8 +27,9 @@
  * Every connection to a named host on a live token is recorded once (R7.3, D67), when it closes
  * or at once when the gate refuses it, as `environment.egress` on the Environment's own stream:
  * the connection is the Environment's, since its token names the pod and turns run in parallel
- * (D66). `runningTurns` lists the turns active on the Environment as it opened (read as the name
- * resolves), as context and never as an owner. Host, port, outcome, bytes, duration and, for a
+ * (D66). `runningTurns` lists the turns active on the Environment as it opened, as context and
+ * never as an owner: one read, started as the name resolves and never waited for, so a turn that
+ * moves while it is in flight may show either way. Host, port, outcome, bytes, duration and, for a
  * credential host, the request count and credential ids; never a header value, a path or a body. A refusal
  * before that (no token, a stale one, no `host:port`) stays a log line, and a client that hangs up
  * before the gate answers leaves nothing. A write never holds the tunnel up, and a failed one is
@@ -40,19 +41,16 @@ import { BlockList, connect, isIP } from "node:net";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
 import { bindListener } from "../host/http.js";
+import { hostTuning } from "../tuning.js";
 import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
-/** How many running turns one connection names, at most. */
+/**
+ * How many running turns one connection names, at most: fixed by the `environment.egress` event
+ * contract (`runningTurns` holds at most 16 in `/core/contracts`), which every reader
+ * validates against, so not a setting here.
+ */
 export const EGRESS_RUNNING_TURNS_MAX = 16;
 /** Ports a tunnel may open. */
 export const EGRESS_PORTS = [443, 80];
-/** Tunnels one sandbox may hold open at once. */
-export const EGRESS_MAX_PER_SANDBOX = 64;
-/** A tunnel with no traffic either way for this long is closed. */
-export const EGRESS_IDLE_MS = 5 * 60_000;
-/** How long a sandbox's epoch and allowlist are reused before they are read again. */
-export const EGRESS_CACHE_MS = 5_000;
-/** How long the gate waits for the upstream connection. */
-export const EGRESS_CONNECT_TIMEOUT_MS = 10_000;
 /** Ranges beyond `isPrivateAddress`'s that a tunnel never reaches. */
 const RESERVED = new BlockList();
 for (const [network, prefix] of [
@@ -193,10 +191,11 @@ function connectionRecord(sink, logger, client, at) {
 }
 export async function startEgressGate(options) {
     const { logger, sandboxes } = options;
-    const idleMs = options.idleMs ?? EGRESS_IDLE_MS;
-    const maxPerSandbox = options.maxPerSandbox ?? EGRESS_MAX_PER_SANDBOX;
-    const cacheMs = options.cacheMs ?? EGRESS_CACHE_MS;
-    const connectTimeoutMs = options.connectTimeoutMs ?? EGRESS_CONNECT_TIMEOUT_MS;
+    const tuning = hostTuning().egress;
+    const idleMs = options.idleMs ?? tuning.idleMs;
+    const maxPerSandbox = options.maxPerSandbox ?? tuning.maxTunnelsPerSandbox;
+    const cacheMs = options.cacheMs ?? tuning.cacheMs;
+    const connectTimeoutMs = options.connectTimeoutMs ?? tuning.connectTimeoutMs;
     const blocked = options.blocked ?? isEgressBlocked;
     const lookup = options.lookup ?? ((host) => dnsLookup(host, { all: true, verbatim: true }));
     const dial = options.dial ?? ((address, port) => connect({ host: address, port }));
@@ -208,7 +207,7 @@ export async function startEgressGate(options) {
             return cached.value;
         const value = await sandboxes.live(sandboxId);
         cache.set(sandboxId, { at: Date.now(), value });
-        if (cache.size > 4096)
+        if (cache.size > tuning.cacheEntries)
             cache.delete(cache.keys().next().value);
         return value;
     }
@@ -260,7 +259,8 @@ export async function startEgressGate(options) {
             return refuse(403, "not_a_host_name", { sandboxId }, `${host} is not a host name; IP literals are refused`);
         if (!egressAllows(host, sandbox.allow))
             return refuse(403, "host_not_allowed", { sandboxId }, `${host} is not in this sandbox's network.allow`);
-        // The turns running on the Environment as the connection opens, read while the name resolves.
+        // The turns running on the Environment as the connection opens: the read starts as the
+        // name resolves, and the 200 does not wait for it.
         record.opened();
         let mine = open.get(sandboxId);
         if (!mine)
@@ -353,8 +353,8 @@ export async function startEgressGate(options) {
         res.writeHead(405, { allow: "CONNECT", "content-type": "text/plain; charset=utf-8", connection: "close" });
         res.end("egress-gate: only CONNECT is served; set HTTPS_PROXY and HTTP_PROXY to this address\n");
     });
-    server.headersTimeout = 10_000;
-    server.requestTimeout = 15_000;
+    server.headersTimeout = tuning.headersTimeoutMs;
+    server.requestTimeout = tuning.requestTimeoutMs;
     server.on("connect", (req, client, head) => {
         // A client socket: idle from the request on, through the tunnel's life.
         client.on("error", () => { });

package/dist/gates/fixture-model.js

@@ -1,9 +1,13 @@
+import { FILES_MESSAGE_HEADER } from "@nylorun/harness";
 export const FIXTURE_PROVIDER = "fixture";
 const MARKER = /^fixture:(\w+)(?:\s+([\s\S]*))?$/;
 /** The fixture model's answer to `call`. */
 export async function fixtureAnswer(call, signal) {
-    const last = call.prompt.at(-1);
-    const users = call.prompt.filter((item) => item.kind === "message" && item.role === "user");
+    // Our harness ends a turn that has files with a user message listing them; the script is in
+    // the message before it, and a tool result before it is still the last thing that happened.
+    const prompt = call.prompt.filter((item) => !isFilesMessage(item));
+    const last = prompt.at(-1);
+    const users = prompt.filter((item) => item.kind === "message" && item.role === "user");
     const marker = MARKER.exec(textOf(users.at(-1)?.content ?? []).trim());
     if (marker)
         return scripted(call, marker[1], marker[2]?.trim() ?? "", last, signal);
@@ -74,6 +78,13 @@ function candidate(call, output) {
 }
 /** About four characters a token, at least one. */
 const tokens = (text) => Math.max(1, Math.ceil(text.length / 4));
+/** The user message our harness adds for the turn's files (`FILES_MESSAGE_HEADER`). */
+function isFilesMessage(item) {
+    if (item.kind !== "message" || item.role !== "user")
+        return false;
+    const first = item.content[0];
+    return first?.type === "text" && first.text === FILES_MESSAGE_HEADER;
+}
 function textOf(content, json = false) {
     return content
         .map((part) => (part.type === "text" ? (part.text ?? "") : json ? JSON.stringify(part) : ""))

package/dist/gates/handler.d.ts

@@ -1,12 +1,10 @@
 import type { Logger } from "../tenant/types.js";
 import type { BlobStore } from "../blob/index.js";
-import type { ModelCallSettings, ModelGate, ModelGateRequest } from "./model-gate.js";
+import type { ModelGate, ModelGateRequest } from "./model-gate.js";
 import { type TenantVaults } from "./tenant-vaults.js";
 export interface ModelCallHandlerOptions {
     readonly vaults: TenantVaults;
     readonly logger: Logger;
-    /** Retries and timeouts; `piModel`'s defaults when absent. */
-    readonly settings?: ModelCallSettings;
     /** The Object store, for the files a prompt names (protocol 6). */
     readonly blobs?: BlobStore;
 }

package/dist/gates/handler.js

@@ -6,11 +6,11 @@
  * the Tenant's ledger. Logs one line per call, never the prompt, the output or a credential.
  */
 import { classifyThrown } from "../model/classify.js";
-import { callFiles, inProcessModelGate, serve } from "./in-process.js";
+import { callFiles, inProcessModelGate, modelCallSettings, serve } from "./in-process.js";
 import { createMeter } from "./meter.js";
 import { GateRefusal } from "./tenant-vaults.js";
 export function createModelCallHandler(options) {
-    const { vaults, logger, settings, blobs } = options;
+    const { vaults, logger, blobs } = options;
     const meter = createMeter({ logger });
     return {
         async call(named, signal) {
@@ -25,7 +25,8 @@ export function createModelCallHandler(options) {
                     root: vault.root,
                     readHostModel: () => vault.readHostModel(),
                     writeHostCredential: (credential) => vault.writeHostCredential(credential),
-                    ...(settings ? { settings } : {}),
+                    // The Tenant's Runtime limits `model*`, read for this call.
+                    settings: await modelCallSettings(vault.store),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),
                 });
                 outcome = await meter.call(vault.store, call, () => serve(vault.store, gate, call, signal));

package/dist/gates/http-client.d.ts

@@ -1,13 +1,14 @@
 import type { ModelGate } from "./model-gate.js";
 import type { RunTokens } from "../tenant/run-grants.js";
-/** Above the gate's 600 s provider request timeout. */
-export declare const GATE_CLIENT_TIMEOUT_MS = 630000;
 export interface HttpModelGateOptions {
     /** The gates service, e.g. `http://gateway:4100` (`NYLORUN_GATES_URL`). */
     readonly url: string;
     /** The run token of each session an advance of this process owns: a call's credential. */
     readonly runTokens: RunTokens;
-    /** How long the connection may stay silent. Default `GATE_CLIENT_TIMEOUT_MS`. */
+    /**
+     * How long the connection may stay silent. Default `gates.clientTimeoutMs` (Host tuning, 630 s),
+     * above the gate's 600 s provider request timeout.
+     */
     readonly timeoutMs?: number;
 }
 export declare function httpModelGate(options: HttpModelGateOptions): ModelGate;

package/dist/gates/http-client.js

@@ -19,14 +19,11 @@ import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { failure } from "../model/classify.js";
 import { MODEL_CALLS_PATH, TENANT_HEADER, } from "./contract.js";
-/** How long a cancel may take; the call it stops ends with the provider timeout anyway. */
-const CANCEL_TIMEOUT_MS = 2_000;
-/** Above the gate's 600 s provider request timeout. */
-export const GATE_CLIENT_TIMEOUT_MS = 630_000;
+import { hostTuning } from "../tuning.js";
 export function httpModelGate(options) {
     const endpoint = new URL(MODEL_CALLS_PATH, options.url);
     const send = endpoint.protocol === "https:" ? httpsRequest : httpRequest;
-    const timeoutMs = options.timeoutMs ?? GATE_CLIENT_TIMEOUT_MS;
+    const timeoutMs = options.timeoutMs ?? hostTuning().gates.clientTimeoutMs;
     const where = new URL(options.url).origin;
     return {
         recovers: true,
@@ -44,7 +41,8 @@ export function httpModelGate(options) {
                         [TENANT_HEADER]: request.tenantId,
                         "content-length": 0,
                     },
-                    timeout: CANCEL_TIMEOUT_MS,
+                    // A cancel is short; the call it stops ends with the provider timeout anyway.
+                    timeout: hostTuning().gates.shortTimeoutMs,
                 }, (response) => {
                     response.resume();
                     response.on("end", resolve);
@@ -107,7 +105,7 @@ export function httpModelGate(options) {
                     responded = true;
                     readBody(response).then((text) => settle(answer(response.statusCode ?? 0, text)), (error) => lost(error));
                 });
-                outgoing.on("socket", (socket) => socket.setKeepAlive(true, 30_000));
+                outgoing.on("socket", (socket) => socket.setKeepAlive(true, hostTuning().gates.keepAliveMs));
                 outgoing.on("finish", () => {
                     sent = true;
                 });

package/dist/gates/http-tool.d.ts

@@ -1,12 +1,11 @@
 import { type HttpToolTarget, type JsonObject, type ToolManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
+import type { RuntimeLimits } from "@nylorun/core/contracts";
 import { type OutboundPolicy } from "../tenant/outbound.js";
 import type { Logger } from "../tenant/types.js";
 import type { AuthorizeResult } from "../vault/service.js";
 import type { McpCredentialRequest } from "../vault/sources.js";
 import type { TenantVaults } from "./tenant-vaults.js";
-/** How much of a failed answer's body the model sees. */
-export declare const HTTP_ERROR_BODY_CHARS = 2000;
 /** What an HTTP request came to, as a tool outcome. */
 export type HttpOutcome = {
     readonly kind: "completed";
@@ -49,17 +48,29 @@ export interface HttpToolCall {
      */
     readonly traceparent?: string;
 }
-/** What `runHttpTool` reads of the Tenant: the session's pinned manifest and its credentials. */
+/**
+ * What `runHttpTool` reads of the Tenant: the session's pinned manifest, its credentials, and its
+ * Runtime limits (`toolAnswerBytes`, `httpToolTimeoutMs`, `errorExcerptChars`), read for each call.
+ */
 export interface HttpToolTenant {
     session(sessionId: string): Promise<{
         readonly manifest: unknown;
     } | undefined>;
     authorize(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
+    limits(): Promise<HttpToolLimits>;
 }
+/** The Runtime limits an HTTP tool call keeps to. */
+export type HttpToolLimits = Pick<RuntimeLimits, "toolAnswerBytes" | "httpToolTimeoutMs" | "errorExcerptChars">;
 /** The HTTP tool `toolName` of the agent `agentId` (the root when absent). */
 export declare function declaredHttpTool(manifest: unknown, agentId: string | undefined, toolName: string | undefined): (ToolManifest & {
     readonly http: HttpToolTarget;
 }) | undefined;
+/**
+ * Why `manifest` cannot be deployed: each HTTP tool of it, or of an agent it uses as a tool, whose
+ * `timeoutMs` is longer than the Tenant's Runtime limit `httpToolTimeoutMs`. A call also waits at
+ * most the limit in force then (`callHttpTarget`).
+ */
+export declare function httpToolTimeoutIssues(manifest: unknown, limitMs: number): string[];
 /** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
 export declare function declaredFlowHttp(manifest: unknown, stage: string | undefined): import("@nylorun/core/define").FlowHttpTarget | undefined;
 /**
@@ -67,7 +78,10 @@ export declare function declaredFlowHttp(manifest: unknown, stage: string | unde
  * flow's HTTP stages or HTTP verifiers (a flow `tool` effect, named by its stage key).
  */
 export declare function isHttpToolCall(manifest: unknown, request: HostEffect): boolean;
-/** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
+/**
+ * The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, by the declared name
+ * its target names, or its flow stage.
+ */
 export declare function httpToolRefOf(request: HostEffect): HttpToolRef;
 /**
  * Sends `input` to `target` and reads the answer. Never throws: everything that can happen to
@@ -77,6 +91,12 @@ export declare function callHttpTarget(target: HttpToolTarget, input: unknown, o
     readonly headers: Readonly<Record<string, string>>;
     readonly policy: OutboundPolicy;
     readonly signal: AbortSignal;
+    /**
+     * The Tenant's Runtime limits: the largest answer read (`toolAnswerBytes`; past it,
+     * `http.too-large`), the longest the tool may wait (`httpToolTimeoutMs`, which its own
+     * `timeoutMs` may not pass) and how much of an error answer is quoted (`errorExcerptChars`).
+     */
+    readonly limits: HttpToolLimits;
     /** Checked against the answer; a mismatch is `tool.invalid-output`. */
     readonly outputSchema?: JsonObject;
 }): Promise<HttpOutcome>;

package/dist/gates/http-tool.js

@@ -3,8 +3,10 @@
  * The loop names the tool; the gate finds its URL, method and credential in the session's pinned
  * manifest, as it finds a remote MCP server, so the loop never chooses a URL or a credential.
  *
- * `callHttpTarget` is the request and its answer, for any declared HTTP target: the input as a
- * JSON body under the Host's address policy (`tenant/outbound.ts`), a 2xx answer as the output
+ * `callHttpTarget` is the request and its answer, for any declared HTTP target: the input as
+ * core's `httpToolRequest` maps it (path parameters in the URL, the rest as a JSON body or, for
+ * `GET` and `DELETE`, the query string) under the Host's address policy (`tenant/outbound.ts`),
+ * a 2xx answer as the output
  * (JSON, or text when the answer is not JSON and no output schema asks for JSON), and every other
  * answer, a timeout or a refused address as a failed outcome the model sees. `runHttpTool` adds
  * what a tool call needs: the declaration, the vault credential and the identity headers.
@@ -14,12 +16,11 @@
  * `Nylorun-Agent-Id` is the flow agent's.
  */
 import { AGENT_ID_HEADER, SESSION_ID_HEADER, TURN_ID_HEADER, } from "@nylorun/core/compatibility";
-import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, flowHttpTarget, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
+import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, delegatesOf, flowHttpTarget, httpPathParameters, httpToolRequest, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
 import { scrubValues } from "../redact.js";
-import { MAX_RESPONSE_BYTES, post } from "../tenant/outbound.js";
+import { send } from "../tenant/outbound.js";
 import { credentialSecrets } from "../vault/headers.js";
-/** How much of a failed answer's body the model sees. */
-export const HTTP_ERROR_BODY_CHARS = 2_000;
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 /** The HTTP tool `toolName` of the agent `agentId` (the root when absent). */
 export function declaredHttpTool(manifest, agentId, toolName) {
     const root = manifest;
@@ -29,6 +30,24 @@ export function declaredHttpTool(manifest, agentId, toolName) {
     const tool = agent?.tools?.find((item) => item.name === toolName);
     return tool?.http ? tool : undefined;
 }
+/**
+ * Why `manifest` cannot be deployed: each HTTP tool of it, or of an agent it uses as a tool, whose
+ * `timeoutMs` is longer than the Tenant's Runtime limit `httpToolTimeoutMs`. A call also waits at
+ * most the limit in force then (`callHttpTarget`).
+ */
+export function httpToolTimeoutIssues(manifest, limitMs) {
+    const root = manifest;
+    if (!root || typeof root !== "object" || isWorkflowManifest(root))
+        return [];
+    return [root, ...delegatesOf(root).map((delegate) => delegate.manifest)].flatMap((agent) => (agent.tools ?? []).flatMap((tool) => {
+        const asked = tool.http?.timeoutMs;
+        return asked !== undefined && asked > limitMs
+            ? [
+                `HTTP tool '${tool.name}' of agent '${agent.id}' asks for timeoutMs ${asked}; the Runtime limit httpToolTimeoutMs allows at most ${limitMs} (PUT /v1/tenant/limits).`,
+            ]
+            : [];
+    }));
+}
 /** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
 export function declaredFlowHttp(manifest, stage) {
     return stage !== undefined && isWorkflowManifest(manifest)
@@ -42,18 +61,24 @@ export function declaredFlowHttp(manifest, stage) {
 export function isHttpToolCall(manifest, request) {
     if (request.kind !== "tool")
         return false;
-    if (request.toolName === undefined)
+    // An agent's call names what runs it (protocol 15): an `http` call names its declared tool.
+    if (request.target?.kind === "http")
+        return declaredHttpTool(manifest, request.agent?.id, request.target.tool) !== undefined;
+    if (request.target === undefined && request.toolName === undefined)
         return declaredFlowHttp(manifest, request.key) !== undefined;
-    return declaredHttpTool(manifest, request.agent?.id, request.toolName) !== undefined;
+    return false;
 }
-/** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
+/**
+ * The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, by the declared name
+ * its target names, or its flow stage.
+ */
 export function httpToolRefOf(request) {
-    if (request.toolName === undefined)
+    if (request.target?.kind !== "http")
         return { sessionId: request.sessionId, stage: request.key };
     return {
         sessionId: request.sessionId,
         ...(request.agent ? { agentId: request.agent.id } : {}),
-        toolName: request.toolName,
+        toolName: request.target.tool,
     };
 }
 /**
@@ -61,12 +86,17 @@ export function httpToolRefOf(request) {
  * the request is an outcome. Rejects only when `signal` aborts, with its reason.
  */
 export async function callHttpTarget(target, input, options) {
-    const timeoutMs = target.timeoutMs ?? HTTP_TOOL_DEFAULT_TIMEOUT_MS;
+    const request = httpToolRequest(target, input);
+    if ("issue" in request)
+        return failed("tool.invalid-input", request.issue);
+    const { limits } = options;
+    const timeoutMs = Math.min(target.timeoutMs ?? HTTP_TOOL_DEFAULT_TIMEOUT_MS, limits.httpToolTimeoutMs);
     const timeout = AbortSignal.timeout(timeoutMs);
-    const result = await post(target.url, JSON.stringify(input ?? {}), { ...options.headers }, {
+    const result = await send(request.url, request.body, { ...options.headers }, {
         policy: options.policy,
-        method: target.method ?? "POST",
+        method: request.method,
         signal: AbortSignal.any([options.signal, timeout]),
+        maxResponseBytes: limits.toolAnswerBytes,
     });
     if (options.signal.aborted)
         throw options.signal.reason;
@@ -80,14 +110,15 @@ export async function callHttpTarget(target, input, options) {
         case "lost":
             return failed("http.lost", `The connection was lost after the request was sent, so the call may have run: ${result.message}`);
         case "too_large":
-            return failed("http.too-large", `The answer (HTTP ${result.status}) is larger than ${MAX_RESPONSE_BYTES} bytes`);
+            return failed("http.too-large", `The answer (HTTP ${result.status}) is larger than ${limits.toolAnswerBytes} bytes (the Runtime limit toolAnswerBytes)`);
     }
     // The service answered, so the outcome is known; never retried, and its body is not shown (R2b C1).
     if (result.status === 401)
         return failed("credential_rejected", "The service answered HTTP 401: it rejected the credential, or needs one");
     const text = result.body.toString("utf8");
     if (result.status < 200 || result.status > 299) {
-        const body = text.length > HTTP_ERROR_BODY_CHARS ? `${text.slice(0, HTTP_ERROR_BODY_CHARS)}…` : text;
+        const chars = limits.errorExcerptChars;
+        const body = text.length > chars ? `${text.slice(0, chars)}…` : text;
         return failed("http.status", `The service answered HTTP ${result.status}${body ? `: ${body}` : ""}`);
     }
     const type = String(result.headers["content-type"] ?? "");
@@ -170,7 +201,10 @@ export async function runHttpTool(tenant, call, options) {
                 return failed("http.credential", `The session's Environment holds no credential '${http.credential}' for ${authorized.url}`);
             credential = authorized.headers;
             identity = authorized.identity;
-            // A credential with `via` sends the call there, a gateway (R2b C2, Q9).
+            // A credential with `via` sends the call there, a gateway (R2b C2, Q9): to its one URL, so
+            // it has no place for the tool's URL parameters.
+            if (authorized.via !== undefined && httpPathParameters(http.url).length > 0)
+                return failed("http.credential", `The credential '${http.credential}' sends calls to its via URL, which cannot take the tool's {field} URL parameters`);
             if (authorized.via !== undefined)
                 target = { ...http, url: authorized.via };
         }
@@ -185,6 +219,7 @@ export async function runHttpTool(tenant, call, options) {
             },
             policy: options.policy,
             signal: options.signal,
+            limits: await tenant.limits(),
             ...(declared.outputSchema === undefined ? {} : { outputSchema: declared.outputSchema }),
         });
         // Nothing the service echoes of the credential reaches the model, an event or the gate's
@@ -205,6 +240,7 @@ export function gateHttpTools(vaults, policy, logger) {
         call: (tenantId, call, signal) => runHttpTool({
             session: async (sessionId) => (await vaults.open(tenantId)).session(sessionId),
             authorize: async (sessionId, request) => (await vaults.open(tenantId)).authorizeMcp(sessionId, request),
+            limits: async () => (await vaults.open(tenantId)).store.tx((t) => readRuntimeLimits(t)),
         }, call, { policy, signal, logger }),
     };
 }

package/dist/gates/in-process.d.ts

@@ -37,10 +37,11 @@ export declare function tenantModelGate(options: {
     readonly kek: () => Buffer;
     readonly root: string;
     readonly logger: Logger;
-    readonly settings?: ModelCallSettings;
     /** The Tenant's Object store, for the files a prompt names. */
     readonly blobs?: BlobStore;
 }): ModelGate;
+/** The Tenant's model call settings: its Runtime limits `model*`, read now. */
+export declare function modelCallSettings(store: SessionStore): Promise<Required<ModelCallSettings>>;
 /**
  * Serves one call: from the fixture model while the Tenant's `model.fixture` setting is on (R4.3),
  * else from `gate`. Read per call, so a seed applies to the next call.

package/dist/gates/in-process.js

@@ -1,4 +1,5 @@
-import { piModel } from "../model/pi-model.js";
+import { modelCallSettingsOf, piModel } from "../model/pi-model.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 import { HostModelVault } from "../vault/host-model.js";
 import { createMeter } from "./meter.js";
 import { artifactFiles } from "../artifacts/files.js";
@@ -19,18 +20,25 @@ export function callFiles(store, blobs) {
  */
 export function tenantModelGate(options) {
     const vault = new HostModelVault({ store: options.store, kek: options.kek });
-    const gate = inProcessModelGate({
-        root: options.root,
-        readHostModel: () => vault.readHostModel(),
-        writeHostCredential: (credential) => vault.updateHostCredential(credential),
-        ...(options.settings ? { settings: options.settings } : {}),
-        ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
-    });
     const meter = createMeter({ logger: options.logger });
     return {
-        call: (request, signal) => meter.call(options.store, request, () => serve(options.store, gate, request, signal)),
+        call: (request, signal) => meter.call(options.store, request, async () => {
+            // The Tenant's Runtime limits `model*`, read for this call.
+            const gate = inProcessModelGate({
+                root: options.root,
+                readHostModel: () => vault.readHostModel(),
+                writeHostCredential: (credential) => vault.updateHostCredential(credential),
+                settings: await modelCallSettings(options.store),
+                ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
+            });
+            return serve(options.store, gate, request, signal);
+        }),
     };
 }
+/** The Tenant's model call settings: its Runtime limits `model*`, read now. */
+export async function modelCallSettings(store) {
+    return modelCallSettingsOf(await store.tx((t) => readRuntimeLimits(t)));
+}
 /**
  * Serves one call: from the fixture model while the Tenant's `model.fixture` setting is on (R4.3),
  * else from `gate`. Read per call, so a seed applies to the next call.

package/dist/gates/inflight.d.ts

@@ -49,9 +49,9 @@ export interface InflightCalls<T = ModelGateOutcome> {
     readonly size: number;
 }
 export interface InflightCallsOptions {
-    /** How long a settled outcome is kept. Default 30 minutes. */
+    /** How long a settled outcome is kept. Default `gates.inflightTtlMs` (Host tuning, 30 min). */
     readonly ttlMs?: number;
-    /** Most entries; the oldest settled ones go first. Default 10,000. */
+    /** Most entries; the oldest settled ones go first. Default `gates.inflightMax` (10,000). */
     readonly max?: number;
     readonly now?: () => number;
 }